Static task
static1
Behavioral task
behavioral1
Sample
Trojan-Spy.Win32.Zbot.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Trojan-Spy.Win32.Zbot.exe
Resource
win10v2004-20240802-en
General
-
Target
a52a593d9498e5612ca5bfaf66177995_JaffaCakes118
-
Size
408KB
-
MD5
a52a593d9498e5612ca5bfaf66177995
-
SHA1
f8ea4c11bd43a3adac80e7257f24b8afaa59324c
-
SHA256
08a5474ae56f390f25087a170f97aef4b0b893a10e79bdd379ba3423c502b9ee
-
SHA512
c6f14e7bff79c8b71e12247572403026403365ca5844a5714f336e99c6e64ad991390ac843e8593892905931a20b11d75f95915d8a27a77b6b2a0ba690d406ea
-
SSDEEP
6144:dIjQhHEgM+XTaK5P9d2HzpdLJ3GBxJlZ0intvRA2RUE5TzDoK8X0TmdRQmytod1q:WchHEP+D98zDLJWrJ/AO5ToqTmvRxE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Trojan-Spy.Win32.Zbot.cuc
Files
-
a52a593d9498e5612ca5bfaf66177995_JaffaCakes118.zip
-
Trojan-Spy.Win32.Zbot.cuc.exe windows:5 windows x86 arch:x86
b59c588cc2ca5173d89cdb7f10f06534
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegEnumKeyExA
CryptGetHashParam
GetUserNameW
CryptDestroyHash
CryptAcquireContextW
CryptHashData
RegCloseKey
CryptReleaseContext
RegQueryValueExA
shlwapi
wvnsprintfW
SHDeleteKeyA
wnsprintfW
PathMatchSpecW
PathFindFileNameW
PathFileExistsW
wnsprintfA
PathRemoveFileSpecW
StrCmpNIW
StrStrW
kernel32
WaitForSingleObject
Sections
.qtuz Size: 39KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.odsdyn Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wzcf Size: 5KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ